CORE LIGHTNING SHIPPED ANOTHER SECURITY FIX — THIS TIME THE CODE IS PUBLIC AND ONLY THE TESTS ARE HELD BACK — THE HEAD START FOR NODE RUNNERS IS ALREADY RUNNING

Core Lightning released version 26.06.8 on September 22 at 9:38 AM ET. The maintainers call it bug fixes “alongside fixes for vulnerabilities responsibly reported by a number of sources,” and say: “We strongly recommend upgrading to this release.” The thank-you list names 13 reporters, including Bitcoin Red Team, plus others who chose to stay anonymous. The notes do not say what the bugs are or how bad they are.

The handling changed from last time. For 26.06.7 in late August, the source patches were held back for about two weeks while nodes upgraded. This time: “Unlike 26.06.7, there is no embargo period for 26.06.8. The release and the associated fixes are available immediately.” What they kept back is “a small number of tests,” to make it harder for attackers to “quickly identify, reverse-engineer, and exploit” the bugs.

Read that as a speed bump. A test shows how to trigger a bug. A fix shows where the bug was. The fix is public, so anyone comparing 26.06.7 to 26.06.8 can see which code changed. The head start for node runners began when the release went up, not when the tests come out. Upgrade now, and if you run Docker, check what you actually pulled: in late August some images showed the new version number without the fixes inside. Two more notes from the release: a node that ran development builds cannot go back to 26.06.x, and zero-conf channels with peers you do not trust are discouraged. At the time of this writing, bitcoin was $86,250.